diff --git a/Gemfile b/Gemfile
index f492523..21945f8 100644
--- a/Gemfile
+++ b/Gemfile
@@ -4,7 +4,7 @@ source 'https://rubygems.org'
 
 ruby RUBY_VERSION
 
-DECIDIM_VERSION = '~> 0.18.0'
+DECIDIM_VERSION = { git: 'https://github.com/decidim/decidim.git', branch: '0.18-stable' }
 
 gem 'daemons'
 gem 'delayed_job_active_record'
@@ -17,6 +17,11 @@ gem 'openssl'
 
 gem 'decidim', DECIDIM_VERSION
 
+# Force gem version to fix:
+# undefined method `polymorphic?' for ActiveRecord::Reflection::PolymorphicReflection
+# See: https://github.com/activerecord-hackery/ransack/issues/1039
+gem 'ransack', '2.1.1'
+
 group :development, :test do
   gem 'better_errors'
   gem 'binding_of_caller'
diff --git a/Gemfile.lock b/Gemfile.lock
index 3786caf..e68d145 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,136 +1,8 @@
-GEM
-  remote: https://rubygems.org/
+GIT
+  remote: https://github.com/decidim/decidim.git
+  revision: 5e0aa6b02ef77d1ec16d2c402f8b1f52a2887ae3
+  branch: 0.18-stable
   specs:
-    actioncable (5.2.3)
-      actionpack (= 5.2.3)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-    actionmailer (5.2.3)
-      actionpack (= 5.2.3)
-      actionview (= 5.2.3)
-      activejob (= 5.2.3)
-      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 2.0)
-    actionpack (5.2.3)
-      actionview (= 5.2.3)
-      activesupport (= 5.2.3)
-      rack (~> 2.0)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.3)
-      activesupport (= 5.2.3)
-      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    active_link_to (1.0.5)
-      actionpack
-      addressable
-    activejob (5.2.3)
-      activesupport (= 5.2.3)
-      globalid (>= 0.3.6)
-    activemodel (5.2.3)
-      activesupport (= 5.2.3)
-    activerecord (5.2.3)
-      activemodel (= 5.2.3)
-      activesupport (= 5.2.3)
-      arel (>= 9.0)
-    activestorage (5.2.3)
-      actionpack (= 5.2.3)
-      activerecord (= 5.2.3)
-      marcel (~> 0.3.1)
-    activesupport (5.2.3)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-    acts_as_list (0.9.19)
-      activerecord (>= 3.0)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
-    arel (9.0.0)
-    ast (2.4.0)
-    autoprefixer-rails (8.6.5)
-      execjs
-    axiom-types (0.1.1)
-      descendants_tracker (~> 0.0.4)
-      ice_nine (~> 0.11.0)
-      thread_safe (~> 0.3, >= 0.3.1)
-    babel-source (5.8.35)
-    babel-transpiler (0.7.0)
-      babel-source (>= 4.0, < 6)
-      execjs (~> 2.0)
-    batch-loader (1.4.1)
-    bcrypt (3.1.13)
-    better_errors (2.5.0)
-      coderay (>= 1.0.0)
-      erubi (>= 1.0.0)
-      rack (>= 0.9.0)
-    better_html (1.0.14)
-      actionview (>= 4.0)
-      activesupport (>= 4.0)
-      ast (~> 2.0)
-      erubi (~> 1.4)
-      html_tokenizer (~> 0.0.6)
-      parser (>= 2.4)
-      smart_properties
-    bindex (0.5.0)
-    binding_of_caller (0.8.0)
-      debug_inspector (>= 0.0.1)
-    builder (3.2.3)
-    byebug (10.0.2)
-    capybara (3.26.0)
-      addressable
-      mini_mime (>= 0.1.3)
-      nokogiri (~> 1.8)
-      rack (>= 1.6.0)
-      rack-test (>= 0.6.3)
-      regexp_parser (~> 1.5)
-      xpath (~> 3.2)
-    carrierwave (1.3.1)
-      activemodel (>= 4.0.0)
-      activesupport (>= 4.0.0)
-      mime-types (>= 1.16)
-    cells (4.1.7)
-      declarative-builder (< 0.2.0)
-      declarative-option (< 0.2.0)
-      tilt (>= 1.4, < 3)
-      uber (< 0.2.0)
-    cells-erb (0.1.0)
-      cells (~> 4.0)
-      erbse (>= 0.1.1)
-    cells-rails (0.0.9)
-      actionpack (>= 3.0)
-      cells (>= 4.1.6, < 5.0.0)
-    charlock_holmes (0.7.6)
-    childprocess (1.0.1)
-      rake (< 13.0)
-    chronic (0.10.2)
-    coderay (1.1.2)
-    coercible (1.0.0)
-      descendants_tracker (~> 0.0.1)
-    coffee-rails (5.0.0)
-      coffee-script (>= 2.2.0)
-      railties (>= 5.2.0)
-    coffee-script (2.4.1)
-      coffee-script-source
-      execjs
-    coffee-script-source (1.12.2)
-    concurrent-ruby (1.1.5)
-    crack (0.4.3)
-      safe_yaml (~> 1.0.0)
-    crass (1.0.4)
-    css_parser (1.7.0)
-      addressable
-    daemons (1.3.1)
-    date_validator (0.9.0)
-      activemodel
-      activesupport
-    db-query-matchers (0.9.0)
-      activesupport (>= 4.0, <= 6.0)
-      rspec (~> 3.0)
-    debug_inspector (0.0.3)
     decidim (0.18.0)
       decidim-accountability (= 0.18.0)
       decidim-admin (= 0.18.0)
@@ -217,6 +89,7 @@ GEM
       omniauth (~> 1.6)
       omniauth-facebook (~> 4.0)
       omniauth-google-oauth2 (~> 0.5.0)
+      omniauth-rails_csrf_protection (~> 0.1)
       omniauth-twitter (~> 1.4)
       paper_trail (~> 9.0)
       pg (>= 0.18, < 2)
@@ -284,16 +157,16 @@ GEM
     decidim-participatory_processes (0.18.0)
       decidim-core (= 0.18.0)
     decidim-proposals (0.18.0)
-      acts_as_list (>= 0.9)
+      acts_as_list (~> 0.9)
       cells-erb (~> 0.1.0)
       cells-rails (~> 0.0.9)
       decidim-comments (= 0.18.0)
       decidim-core (= 0.18.0)
-      diffy (>= 3.3)
-      doc2text (>= 0.4.0)
-      kaminari (~> 1.0)
-      ransack (~> 2.0)
-      redcarpet (>= 3.4)
+      diffy (~> 3.3)
+      doc2text (~> 0.4.0)
+      kaminari (~> 1.1)
+      ransack (~> 2.1.1)
+      redcarpet (~> 3.4)
       social-share-button (~> 1.0)
     decidim-sortitions (0.18.0)
       decidim-admin (= 0.18.0)
@@ -315,6 +188,140 @@ GEM
       sassc-rails (~> 1.3)
     decidim-verifications (0.18.0)
       decidim-core (= 0.18.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (5.2.3)
+      actionpack (= 5.2.3)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+    actionmailer (5.2.3)
+      actionpack (= 5.2.3)
+      actionview (= 5.2.3)
+      activejob (= 5.2.3)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 2.0)
+    actionpack (5.2.3)
+      actionview (= 5.2.3)
+      activesupport (= 5.2.3)
+      rack (~> 2.0)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.2.3)
+      activesupport (= 5.2.3)
+      builder (~> 3.1)
+      erubi (~> 1.4)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
+    active_link_to (1.0.5)
+      actionpack
+      addressable
+    activejob (5.2.3)
+      activesupport (= 5.2.3)
+      globalid (>= 0.3.6)
+    activemodel (5.2.3)
+      activesupport (= 5.2.3)
+    activerecord (5.2.3)
+      activemodel (= 5.2.3)
+      activesupport (= 5.2.3)
+      arel (>= 9.0)
+    activestorage (5.2.3)
+      actionpack (= 5.2.3)
+      activerecord (= 5.2.3)
+      marcel (~> 0.3.1)
+    activesupport (5.2.3)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    acts_as_list (0.9.19)
+      activerecord (>= 3.0)
+    addressable (2.6.0)
+      public_suffix (>= 2.0.2, < 4.0)
+    arel (9.0.0)
+    ast (2.4.0)
+    autoprefixer-rails (8.6.5)
+      execjs
+    axiom-types (0.1.1)
+      descendants_tracker (~> 0.0.4)
+      ice_nine (~> 0.11.0)
+      thread_safe (~> 0.3, >= 0.3.1)
+    babel-source (5.8.35)
+    babel-transpiler (0.7.0)
+      babel-source (>= 4.0, < 6)
+      execjs (~> 2.0)
+    batch-loader (1.4.1)
+    bcrypt (3.1.13)
+    better_errors (2.5.0)
+      coderay (>= 1.0.0)
+      erubi (>= 1.0.0)
+      rack (>= 0.9.0)
+    better_html (1.0.14)
+      actionview (>= 4.0)
+      activesupport (>= 4.0)
+      ast (~> 2.0)
+      erubi (~> 1.4)
+      html_tokenizer (~> 0.0.6)
+      parser (>= 2.4)
+      smart_properties
+    bindex (0.5.0)
+    binding_of_caller (0.8.0)
+      debug_inspector (>= 0.0.1)
+    builder (3.2.3)
+    byebug (10.0.2)
+    capybara (3.28.0)
+      addressable
+      mini_mime (>= 0.1.3)
+      nokogiri (~> 1.8)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (~> 1.5)
+      xpath (~> 3.2)
+    carrierwave (1.3.1)
+      activemodel (>= 4.0.0)
+      activesupport (>= 4.0.0)
+      mime-types (>= 1.16)
+    cells (4.1.7)
+      declarative-builder (< 0.2.0)
+      declarative-option (< 0.2.0)
+      tilt (>= 1.4, < 3)
+      uber (< 0.2.0)
+    cells-erb (0.1.0)
+      cells (~> 4.0)
+      erbse (>= 0.1.1)
+    cells-rails (0.0.9)
+      actionpack (>= 3.0)
+      cells (>= 4.1.6, < 5.0.0)
+    charlock_holmes (0.7.6)
+    childprocess (1.0.1)
+      rake (< 13.0)
+    chronic (0.10.2)
+    coderay (1.1.2)
+    coercible (1.0.0)
+      descendants_tracker (~> 0.0.1)
+    coffee-rails (5.0.0)
+      coffee-script (>= 2.2.0)
+      railties (>= 5.2.0)
+    coffee-script (2.4.1)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.12.2)
+    concurrent-ruby (1.1.5)
+    crack (0.4.3)
+      safe_yaml (~> 1.0.0)
+    crass (1.0.4)
+    css_parser (1.7.0)
+      addressable
+    daemons (1.3.1)
+    date_validator (0.9.0)
+      activemodel
+      activesupport
+    db-query-matchers (0.9.0)
+      activesupport (>= 4.0, <= 6.0)
+      rspec (~> 3.0)
+    debug_inspector (0.0.3)
     declarative-builder (0.1.0)
       declarative-option (< 0.2.0)
     declarative-option (0.1.0)
@@ -325,13 +332,13 @@ GEM
       delayed_job (>= 3.0, < 5)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devise (4.6.2)
+    devise (4.7.0)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 6.0)
+      railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
-    devise-i18n (1.8.0)
+    devise-i18n (1.8.1)
       devise (>= 4.6)
     devise_invitable (1.7.5)
       actionmailer (>= 4.1.0)
@@ -398,6 +405,7 @@ GEM
     highline (2.0.2)
     html_tokenizer (0.0.7)
     htmlentities (4.3.4)
+    http-accept (1.7.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
     httparty (0.16.4)
@@ -483,9 +491,9 @@ GEM
     multipart-post (2.1.1)
     mustache (1.1.0)
     netrc (0.11.0)
-    nio4r (2.4.0)
+    nio4r (2.5.1)
     nobspw (0.6.1)
-    nokogiri (1.10.3)
+    nokogiri (1.10.4)
       mini_portile2 (~> 2.4.0)
     oauth (0.5.4)
     oauth2 (1.4.1)
@@ -509,6 +517,9 @@ GEM
     omniauth-oauth2 (1.6.0)
       oauth2 (~> 1.1)
       omniauth (~> 1.9)
+    omniauth-rails_csrf_protection (0.1.2)
+      actionpack (>= 4.2)
+      omniauth (>= 1.3.1)
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
@@ -562,7 +573,7 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.4)
+    rails-html-sanitizer (1.2.0)
       loofah (~> 2.2, >= 2.2.2)
     rails-i18n (5.1.3)
       i18n (>= 0.7, < 2)
@@ -589,7 +600,7 @@ GEM
       activesupport (>= 4.1.0)
       virtus (~> 1.0.5)
       wisper (>= 1.6.1)
-    redcarpet (3.4.0)
+    redcarpet (3.5.0)
     redis (4.1.2)
     regexp_parser (1.6.0)
     request_store (1.4.1)
@@ -597,7 +608,8 @@ GEM
     responders (3.0.0)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    rest-client (2.0.2)
+    rest-client (2.1.0)
+      http-accept (>= 1.7.0, < 2.0)
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
@@ -744,8 +756,8 @@ DEPENDENCIES
   binding_of_caller
   byebug
   daemons
-  decidim (~> 0.18.0)
-  decidim-dev (~> 0.18.0)
+  decidim!
+  decidim-dev!
   delayed_job_active_record
   faker (~> 1.8.4)
   figaro (>= 1.1.1)
@@ -753,6 +765,7 @@ DEPENDENCIES
   listen (~> 3.1.0)
   openssl
   puma (~> 3.0)
+  ransack (= 2.1.1)
   spring
   spring-watcher-listen (~> 2.0.0)
   uglifier (>= 1.3.0)